Jenkins CVE-2026-84645

Exploitation requires a valid Jenkins account with at minimum the ability to submit or modify config.xml documents - typically Job/Configure, Job/Create, or an equivalent item-level write permission. The attacker must be able to send HTTP requests to the Jenkins web interface (AV:N; no special network position such as adjacency or physical access is required). No victim interaction is needed beyond the attacker's own HTTP requests. Exploitation is limited to instances running Jenkins 2.579/LTS 2.568.2 or earlier; instances patched to 2.580/LTS 2.568.3 are not affected. Fully anonymous or read-only-authenticated users cannot exploit this vulnerability, as submitting a config.xml requires write access to at least one configurable item.

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately characterizes this as a network-exploitable flaw requiring only low-privilege authentication, no user interaction, and yielding full confidentiality, integrity, and availability impact. The low authentication barrier is significant in practice: Jenkins instances routinely grant Job/Configure or Job/Create permissions to developers and CI contributors who are not full administrators. The absence of attack complexity (AC:L) and the open-source, well-documented Stapler routing model further lower the bar for independent exploit development. No EPSS score, KEV listing, or confirmed public POC is present in the supplied data, so exploitation urgency cannot be confirmed beyond the CVSS signal. The scope-unchanged (S:U) designation is consistent with impact confined to the Jenkins controller, but Jenkins controllers characteristically run as highly privileged OS users, meaning successful exploitation effectively yields full system compromise. This is a high-priority patch given widespread enterprise deployment and the low auth bar.

An attacker holding a low-privilege Jenkins developer account with Job/Configure permission crafts a config.xml document that embeds a top-level Jenkins configuration object - such as a global plugin configuration or another job definition - as a nested field within a job's config. After submitting the document via the Jenkins API, the embedded object is bound into the server's runtime object graph, and Stapler begins routing HTTP requests through it. The attacker then issues crafted HTTP requests that invoke arbitrary handler methods on the embedded object, achieving remote code execution as the Jenkins process user.